Sensitive File Access - SSH Saved Keys

any where event.category in ("registry", "file") and
 event.action in ("query", "open") and
 user.id like ("S-1-5-21*", "S-1-12-*") and process.executable : "C:\\*" and
 (file.path : "?:\\Users\\*\\.ssh\\known_hosts" or
  registry.path :
        ("HKEY_USERS\\S-1-5-21*\\Software\\SimonTatham\\PuTTY\\SshHostKeys\\*",
         "HKEY_USERS\\S-1-12-1-*\\Software\\SimonTatham\\PuTTY\\SshHostKeys\\*")) and
  not process.executable :
      ("?:\\Program Files\\*",
	   "?:\\Program Files (x86)\\*", 
	   "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MsMpEng.exe", 
	   "?:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*\\MpCopyAccelerator.exe",
	   "?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*\\MsSense.exe",
	   "?:\\Windows\\System32\\OpenSSH\\*.exe", 
	   "?:\\Windows\\System32\\smartscreen.exe", 
	   "?:\\WINDOWS\\system32\\reg.exe", 
	   "?:\\Windows\\regedit.exe", 
	   "?:\\Windows\\System32\\notepad.exe", 
	   "?:\\Windows\\System32\\Robocopy.exe",
	   "?:\\Windows\\System32\\cmd.exe",
	   "?:\\Windows\\explorer.exe",
       "?:\\Windows\\System32\\mmc.exe",
	   "?:\\Windows\\System32\\svchost.exe",
	   "?:\\$WINDOWS.~BT\\Sources\\setuphost.exe",
	   "?:\\Users\\*\\AppData\\Local\\Programs\\Git\\mingw64\\bin\\git.exe",
	   "?:\\Users\\*\\AppData\\Local\\DBeaver\\dbeaver.exe",
	   "?:\\Users\\*\\Tools\\dbeaver\\dbeaver.exe",
	   "?:\\Windows\\System32\\SearchProtocolHost.exe",
	   "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe",
	   "?:\\ProgramData\\GalacticScan\\GalacticScan.exe",
	   "?:\\Users\\*\\AppData\\Local\\Programs\\GalacticScan\\GalacticScan_Warpspeed.exe",
	   "?:\\Users\\*\\AppData\\Local\\Postman\\app-*\\Postman.exe",
	   "?:\\Users\\*\\OneDrive\\*\\Wintriage\\Tools\\ADSecurizame.exe",
	   "?:\\Users\\*\\AppData\\Local\\JetBrains\\Toolbox\\apps\\Gateway\\*\\bin\\gateway64.exe",
	   "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe",
	   "?:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\*\\@vscode\\ripgrep\\bin\\rg.exe",
	   "?:\\programs\\!_local\\SmartGit\\bin\\smartgit.exe",
	   "?:\\Windows\\System32\\dllhost.exe",
	   "?:\\Windows\\System32\\OpenWith.exe",
	   "?:\\Windows\\System32\\userinit.exe",
	   "?:\\Windows\\System32\\fhmanagew.exe",
	   "C:\\OSGeo4W64\\bin\\qgis-ltr-bin.exe",
	   "C:\\Users\\*\\Anaconda3\\pythonw.exe") and

  /* many of the following exclusions are not signed nor have an original file name  */
  not process.name : ("pscp.exe", "psftp.exe", "_ssh.exe", "plink.exe", "PuTTYNG.exe", "putty*.exe", "busybox.exe",
                      "ssh.exe", "WinSCP.exe", "bash.exe", "MoTTY.exe", "eclipse.exe", "code.exe", "datagrip*.exe",
                      "MobaXterm_Personal*.exe", "RoyalTS_PuTTY*.exe", "MAP.EXE", "rssputty.exe", "phpstorm64.exe",
                      "Fork.exe", "fzsftp.exe", "OneDrive.exe") and
  not (process.code_signature.subject_name :
               ("Galactic Advisors, Inc.", "Simon Tatham", "Atlassian Pty Ltd", "Emsisoft Limited", "JetBrains s.r.o.",
                "ESET, spol. s r.o.", "Notepad++", "Open Source Developer, Sven Strickroth", "ShowMyPC", "AXOSOFT, LLC",
                "General Services Administration", "ShowMyPC INC", "Oracle America, Inc.", "CS.DISA-RE11.08-0031", "Mobatek", 
		"DBeaver Corp", "Eclipse.org Foundation, Inc.", "Shadow", "The Qt Company Oy", "Anysphere, Inc.",
		"International Business Machines Corporation", "Red Hat, Inc", "SmartBear Software Inc.",
		"Python Software Foundation", "Amazon.com Services LLC", "OpenJS Foundation", "T3 Tools Inc",
		"KICAD SERVICES CORPORATION", "VNG GROUP JSC", "The FreeCAD project association AISBL") and
       process.code_signature.status in ("trusted", "errorChaining")) and
  process.thread.Ext.call_stack_summary != "ntdll.dll
| cygwin1.dll"